Behavioral Based Insider Threat Detection Using Deep Learning

Rida Nasir

doi:10.1109/ACCESS.2021.3118297

Return

Behavioral Based Insider Threat Detection Using Deep Learning

2021-01-01

DOI：10.1109/ACCESS.2021.3118297

Original

Save

Abstract

En 中文

The most detrimental cyber attacks are usually not originated by malicious outsiders or malware but from trusted insiders. The main advantage insider attackers have over external elements is their ability to bypass security checks and remain undiscovered, this may cause serious damage to the organizational assets. This paper focuses on insider threat detection through behavioral analysis of users. User behavior is categorized as normal or malicious based on user activity. A series of events and activities are analyzed for feature selection to efficiently detect adversarial behavior. Selected feature vectors are used for model training during the implementation phase. A deep learning based approach is proposed that detects insiders with greater accuracy and low false positive rate. A rich event / user role based feature set containing Logon/Logoff events, User_role, Functional_unit etc are used for detection. The dataset used is the CMU CERT synthetic insider threat dataset r4.2. Performance of our proposed algorithm has been compared to other well-known techniques i.e. long short term Memory- convolutional neural network, random forest, long short term memory- recurrent neural network, one class support vector machine, Markov chain model, multi state long short term memory & convolutional neural network, gated recurrent unit & skipgram. The comparison proved that our novel approach produces relatively good accuracy(90.60%), precision(97%) and F1 Score (94%).

Keywords:

Feature extraction

Deep learning

Anomaly detection

Training

Hidden Markov models

Data models

Time series analysis

Insider threat

deep learning

machine learning

user behavior